Working Backwards - <AUTHOR> https://jaydaigle.net/blog/teaching/working-backwards/ <comment><USER2> Goodhart's Law : [https://en.wikipedia.org/wiki/Goodhart%27s_law](https://en.wikipedia.org/wiki/Goodhart%27s_law)

> "When a measure becomes a target, it ceases to be a good measure."

</comment><comment><USER3> this:

> This is one of the dangers, for instance, of getting to reliant on > management-by-metric. Originally you create a metric to measure how well > you're achieving some goal. But over time, people forget about the goal and > remember the metric—and do things that improve the metric, but in ways that > don't advance the original goal.

This is so true, and if one is not vigilant, its easy to get off track.

We've been working on a new service product [1] and running some ad campaigns. I find it interesting how easy it is to get wrapped up in the number of impressions and events generated while users navigate on the site.

I constantly have to work to stay focused on what we can do to get better at converting potential customers. That might include content related to our service - which may generate some traffic and conversions, or it might, for instance, be to write better ad copy that generates a better ratio of clicks:impressions than previous ads. I suspect we'll be bouncing around these two for a little while - but also adding other tests we can measure.

[1] Yukon Data Solutions ..its an analytics service thing.

<comment> white-flame "Metrics are a great servant, but a terrible master."</comment></comment>


Seymour Papert, 88, Dies; Saw Education's Future in Computers - <AUTHOR> http://mobile.nytimes.com/2016/08/02/technology/seymour-papert-88-dies-saw-educations-future-in-computers.html <comment><USER2> Extensive discussion of Papert here: [https://news.ycombinator.com/item?id=12201810](https://news.ycombinator.com/item?id=12201810)</comment>


Hacker Spoofs Cell Phone Tower to Intercept Calls  - <AUTHOR> http://www.wired.com/threatlevel/2010/07/intercepting-cell-phone-calls/ <comment><USER2> This reminds me of OpenBTS, the project to create an open-source GSM interface. A full dev kit costs about $2000.

<http://openbts.sourceforge.net/>

They've been using this system at Burning Man to operate a free experimental cell network:

<http://pagalegba2010.wikispaces.com/PublicInformation>

<comment><USER3> The guy who gave this talk, Chris Paget, actually used OpenBTS in his demo.

</comment></comment><comment><USER4> I believe one of the more important differences between a GSM SIM and 3G USIM is that the network is required to prove its identity to the user.

You can use a standard GSM 2G SIM with a 3G WCDMA network and in that case _only_ the network requires the phone to prove its identity. With a USIM, the network also has to prove its identity.

So you're not automatically protected when using 3G WCDMA network. You need to upgrade to a USIM.

Note: The above refers to 3GPP GSM/WCDMA technology. Not sure about IS-95 (Qualcomm's CDMA) and its multiple variants.

<comment><USER5> I know there are several conversion functions for a USIM to be able to authenticate on a 2G network, but I didn't think it was possible for a 2G SIM to register on a 3G network. Can you explain this more thoroughly?

<comment><USER4> It all depends on the operator. A UMTS (3G) network can accept users using a GSM SIM if the operator allows it.

Authentication is performed by the network HLR (Home location register) which is independent of the radio technology used. The procedure/algorithms are different for 3G-capable UEs with USIM, but the HLR can accept 2G users as well.

Bottom line is that if your 'home carrier' (the one that produced the SIM) allows it, you can use your SIM in any 3G network that is part of the roaming agreement of that carrier.

</comment></comment></comment><comment><USER6> Having recently returned an AT&T 3G MicroCell after a 30 day exercise in futility and "support" horror attempting to activate it in a rural location… _I want one of these!_ [1]

If AT&T won't utilize the spectrum through my land for which they have been given stewardship, then perhaps I ought to be allowed to exercise it.

[1] Except I wouldn't get incoming calls, which is more important to me than outgoing.

<comment><USER7> You could probably setup a system to get incoming calls using something like Google Voice. Get a phone number for a VoIP account, forward GV to it and your real cell phone number, and set up your tower to route VoIP to your handset when it's connected.

</comment></comment><comment><USER8> This reminds me of one of the points in the End-to-End Argument by Saltzer. The network protocol offering to encrypt the payload is broken, because the two end clients should undertake to secure their communication if it's necessary. In this case I have some sympathy though, because it's not easy for two humans speaking with their voices to come up with a way to encrypt it. Maybe the responsibility should fall on the local code running on each phone?

[http://web.mit.edu/Saltzer/www/publications/endtoend/endtoen...](http://web.mit.edu/Saltzer/www/publications/endtoend/endtoend.pdf)

Of course, I know close to nothing about radio security, so maybe the world as it exists today is optimal but the phone makers blundered in ignoring the insecure warning?

<comment><USER9> As far as I understand the issue in this case is not the lack of end-to-end security, it is that it's possible to trick the phone to tranmsit without encryption for regular calls. Non-encrypted calls are needed because it is important to allow making emergency calls (e.g. 911) without a SIM being present or without a PIN number and it's the SIM card that has the encryption key, not the handset.

</comment></comment><comment><USER10> I have it on good authority that the U.S. military uses similar technology overseas for monitoring terrorists.

<comment><USER11> Systems like these (tactical SIGINT, vs. the kind of strategic collection of everything. like NSA does) have been part of war pretty much ever since radio was invented.

Most of Rommel's awesomeness in North Africa was due to his superior radio directing finding units. No need to necessarily translate enemy communications if you know where they are and when they're sending.

The premier tier-1/special mission unit in the US military (Intelligence Support Activity (ISA), aka "the Activity", Gray Fox, Torn Victor, Cemetery Wind, Centra Spike, ... they have a lot of code names) was basically the key piece in killing Pablo Escobar (the book "Killing Pablo" is a pretty good account). They're obviously extensively involved in Iraq and Afghanistan.

One of the major reasons the military was more effective in 2005-now in Iraq, vs. 2003-2004, is that cellphones spread out to cover the whole country, and insurgents and their friends used cellphones (although this is more "strategic" vs. tactical/field gathering like this system).

I'm just waiting for the first fully autonomous weapon which combines signals intelligence and killing -- flies around listening for a specific IMSI, then drops down on the target and blows up.

<comment><USER12> > I'm just waiting for the first fully autonomous weapon which combines > signals intelligence and killing -- flies around listening for a specific > IMSI, then drops down on the target and blows up.

The road to Skynet is paved with these kind of desires.

</comment></comment></comment><comment><USER13> Reminds me of the democratization other security technologies such as described in:

P. W. Singer's "Wired for War"

<http://amzn.to/gSsI>

Perhaps even Chris Anderson's DIY Drones:

<http://DIYDrones.com>

</comment><comment><USER14> As I had not seen this mentioned here or in article; You can read more about Chris's work here, <http://www.tombom.co.uk/blog/> and I would have posted the 'OpenBTS on Droid' a while back if I'd known it was a 'scoop' :) My thoughts were of some kind of shared cellular access point that could be used in the developing world to give access to a sub-let access point with a 'real' connection.

</comment><comment><USER15> This demonstration is neither particularly novel nor particularly legal.

[http://laforge.gnumonks.org/weblog/2010/08/01/#20100801-on_r...](http://laforge.gnumonks.org/weblog/2010/08/01/#20100801-on_recent_news_about_imsi_catcher)

</comment><comment><USER16> Can a similar, simpler method be used to steal WEP/WPA passwords?

Set up a wireless AP broadcasting an existing SSID. Some existing clients connect to it passing the keyphrase. Verify against the actual AP.

Would this work?

<comment><USER17> in WEP's case, your AP would receive an auth response encrypted with the keyphrase... you'd have to get quite a few of these to deduce the password, in general. people find it easier to just sniff traffic and deduce the key from all the traffic generated from someone downloading crap.

i don't think this is at all realistic with wpa.

you could just set up an open network with an equivalent essid, but that's nothing new is it? :)</comment></comment>


What Went Wrong with IBM's Watson - <AUTHOR> https://slate.com/business/2018/08/ibms-watson-how-the-ai-project-to-improve-cancer-treatment-went-wrong.html <comment><USER2> what went wrong? declining share price... oh ok thanks.</comment>


India now has social networks related to caste - <AUTHOR> http://www.bakadesuyo.com/india-now-has-social-networks-related-to-cast

<comment><USER3> I'm Indian, and I disagree with the caste system, but am also cynical enough to think this is no big deal. People will always discriminate against people for one reason or another.

[http://www.google.com/search?hl=en&q=black+social+networ...](http://www.google.com/search?hl=en&q=black+social+networks&aq=f&oq=&aqi=g-c1g-m1)

[http://www.google.com/search?hl=en&q=muslim+social+netwo...](http://www.google.com/search?hl=en&q=muslim+social+networks&aq=f&oq=&aqi=g3)

[http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=jewish+social+networks)

[http://www.google.com/search?hl=en&q=arabic+social+netwo...](http://www.google.com/search?hl=en&q=arabic+social+networks&aq=f&oq=&aqi=)

[http://www.google.com/search?hl=en&q=rich+people+social+...](http://www.google.com/search?hl=en&q=rich+people+social+networks&aq=f&oq=&aqi=)

[http://www.google.com/search?hl=en&q=beautiful+people+so...](http://www.google.com/search?hl=en&q=beautiful+people+social+networks&aq=f&oq=&aqi=)

<comment><USER4> I guess the most odd aspect to an outside observer is how incredibly indistinguishable , at least from a physical observation, caste members are from each other. This is in such stark contrast with the societal confinement it locks people into it borders on a parody on prejudice, were it not so tragic.

EDIT: This star trek episode comes to mind (Are you blind?): <http://www.youtube.com/watch?v=vi7QQ5pO7_A>

<comment><USER3> Why should it matter that they're physically indistinguishable? Would it be more excusable then?

Caste is just another uneducated, thoughtless distinction to discriminate against other people.

Caste is as correlated with cultural identity and upbringing in India as religion, nationality, and skin color are in other parts of the world.

<comment><USER4> No, it shouldn't matter, just an observation it's a dimension of ignorant distinction I'm not used to, is all.

</comment></comment></comment></comment><comment><USER5> I'm Indian, I'm ashamed at this, but can confirm that people give way too much importance to caste in India. Things _are_ changing, but mostly in cities, and at "not enough" pace. Politics is rife with religion/caste/racism etc, because that is the easiest/fastest way for any politician to get votes.

The saddest part is, many highly educated/intelligent (I am talking about Masters/PHds/Ivy league educated) people get hung up on religion/caste.

<comment><USER6> I have some Indian friends and they have said much the same thing. I can't say I'm surprised this happened, the markets are not an engine of morality - <USER2> just give the people what they want for better or worse.

<comment><USER5> That is the sad part. In politics at least, the end always justifies the means, however horrible/unethical/unlawful it is.

</comment></comment></comment><comment><USER4> I always wondered what they think of foreigners outside of the system. Are we "auto-casted" down?

<comment><USER4> Maybe duck typing? If it looks like a Brahmin, talks like a Dalit....?

</comment></comment><comment><USER7> Why, that's backwards! In the U.S. we have castes related to social networks.</comment>


Show HN: Browser based PowerPoint alternative (Beta) - <AUTHOR> https://sizle.io/beta <comment><AUTHOR> Hi all, Sizle is a tool that I built with a friend of mine that is currently in beta. The idea is a web-based presentation platform with much richer animation than existing alternatives, and a suite of viewer analytics and performance metrics for senders to see the performance of their documents, would love to hear any feedback!</comment>


Kiosked raises $30M series B funding to drive global growth - <AUTHOR> http://www.kiosked.com/press-releases/kiosked-raises-30-million-series-b-funding-to-drive-global-growth/ <comment><USER2> Interesting comment that I saw on a Finnish news site regarding this. Its actually just 3,1 million from angel investors, and the rest is loans they have gotten. For example a 15 millon loan from the European Investment Bank.</comment>


Ask HN: White Papers, are they worth it (as a promotional tool)? - <AUTHOR>

Hi,
I am contemplating writing a white paper about a topic relevant to my new start-up. However, in contrast to blog posts which are short; white papers, when done properly, are very time consuming. My audience is people in the business world (not consumers), so they like PDFs. I know enterprise software companies use white papers to get contact information that they turnaround and market to, but we (nimonik.ca) are going more the low-cost web-app route.
So, my question is: Do people read white papers and if so does it drive enough traffic to justify the time invested? Does anyone have a relevant experience?
Thanks in advance,
Jonathan
P.S. My white paper is titled: "How to leverage online communities for to build brand and gain customers". It will attempt to explain the differences of service based companies (linux guys) with traditional shops (microsoft) and how consultants and lawyers (my target audience) can use online communities in their respective industry (I am concerned with environmental issues) to make a name for themselves and get more business. <comment><USER2> FWIW, I'm a small business owner and have downloaded quite a few whitepapers and signed up for quite a few "webinars" that I thought might provide valuable info. Quality varies, but tends to hover well below "wow".

In each of these cases, my contact info was captured. So that part of it works.

The object, however, is not to get a prospect's number, but to get them to call you.

Nothing will light a fire under a potential customer's ass like seeing your product/service in use:

* use customer testimonials/case studies/videos (see mathematica's customer testimonials - <http://is.gd/kk8B> / Highrise customer interviews / etc.)

* make a great, simple video explanation - see <http://commoncraft.com>

* show off the website, twitter stream, etc. of a make-believe lawyer who represents your ideal happy customer (e.g. "let us help you be this awesome."

At the end of the day, I think a whitepaper is too much like a TPS report. You want something that can be shared 'over the shoulder', when someone at a company finds your service and shows it off to his partner or colleague.

</comment><comment><USER3> good question. i've wondered this before, too. no idea. it's hard to know the answer unless you collect a lot of anecdotes.</comment>


Mocha's site is down - <AUTHOR> https://mochajs.org/ <comment><USER2> oof is this susceptible to a takeover? Looks like it's pointing to a deleted Netlify site...</comment>


Welcoming Semmle to GitHub - <AUTHOR> https://github.blog/2019-09-18-github-welcomes-semmle/ <comment><USER2> The linked blog post [0] and the new security marketing page [1] both have a little more detail on what this actually means.

Basically, Semmle offers a static analysis tool that operates on your source code as a graph (from what I understand) and points out bugs and security holes in your code. Github is now offering that for free on repos at all tiers.

[0] [https://github.blog/2019-09-18-securing-software- together/](https://github.blog/2019-09-18-securing-software-together/)

[1] [https://github.com/features/security](https://github.com/features/security)

<comment><USER3> Semmle is basically datalog over source code.

For what it works for, it works nice. But it is not a pancaea.

Security vulnerability finding is almost certainly the wrong target for Semmle - I am unsure why they are trying to push that angle. There are much better stories in things like refactoring and understanding. (I say this having overseen a number of deployments for various reasons, some successful, some not)

<comment><USER4> Nothing is a panacea. Things that help move the needle without requiring tons of time or effort are useful and valuable. I'm really glad to see more efforts in this area.

<comment><USER3> While it's true that there is no pancaea, Semmle will not move the needle on vulnerability finding. This I have extensive data on.

(I mean this in terms of capability, not sudden popularity)

It would move the needle on a bunch else. It is a good tool for sure (and im very happy for them), i just think they will disappoint people by pressing this particular narrative, and wouldn't do so with a different narrative

<comment><USER5> The Datalog part is interesting! Do they have a bunch of rules to make graph queries work nicely, like Datomic pull syntax or maybe some pattern matching syntactic sugar? Is the underlying thing still an EAVT store? Is any of that information publicly available?

<comment><USER6> It looks like they have reasonable docs on their query language, in particular [https://help.semmle.com/QL/learn-ql/about- ql.html#properties...](https://help.semmle.com/QL/learn-ql/about- ql.html#properties-of-ql) has some info on the QL language.

[https://help.semmle.com/lgtm- enterprise/user/help/generate-d...](https://help.semmle.com/lgtm- enterprise/user/help/generate-database.html) says "LGTM generates a database for each commit stored in a repository. Each database is a relational database that represents the structure of the codebase for a specific revision, or snapshot, of the code.", though a triple store could qualify as relational here. I couldn't find much more than that about the implementation details though.

<comment><USER5> Right. I found those docs but they didn't look like datalog queries at all. Of course that doesn't mean they don't compile down to datalog :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I hate that these kinds of Orwellian phrases "Welcoming X to the Y Family" have now become idiomatic of corporate English. Ugh, no. There is no "family" involved here, not by any stretch of the word.

<comment><USER8> To be fair, if a "parent corporation" is a thing, then logically it has children and can be a corporate family.

<comment><USER7> Intent matters. The phrase "parent corporation" has no PR or emotional intent. "Welcoming X to Y family" has a clear emotive intent.

<comment><USER9> Maybe the intent of the writer was to make the new hires feel welcome aboard to their new company.

That's also not mutually exclusive of the emotive intent you are describing. What makes that Orwellian though?

<comment><USER10> The parent comment seems to be criticizing the higher-level corporate trend to use this lingo, and isn't talking about Friedman or Github specifically.

</comment></comment></comment></comment></comment><comment><USER11> Free hint for the GitLab - they can integrate a similar but open source tool - Infer[1]. Essentially it provides the similar features, just lacks a good interface to do so. They also have a query language, called AL[2]. It is way less polished than Semmle, but opensource and with a good potential.

[1] [https://github.com/facebook/infer](https://github.com/facebook/infer)

[2] [https://fbinfer.com/docs/linters.html](https://fbinfer.com/docs/linters.html)

</comment><comment><USER12> Interesting to see the differences between Github and Gitlab's strategy in this arena.

Github appears to be going the aqui-hire route with Semmle, dependabot, pullpanda etc, where as I don't think Gitlab's made an acquisition for a year or two.

<comment><USER13> GitLab published what they're interested in: [https://about.gitlab.com/handbook/acquisitions/](https://about.gitlab.com/handbook/acquisitions/). It's an amazing, one-of-a-kind doc. One of their constraints ([https://about.gitlab.com/handbook/acquisitions/#what-we- offe...](https://about.gitlab.com/handbook/acquisitions/#what-we-offer)) is quite limiting, though:

> The total purchase price of the deal, paid in cash, will not exceed $1M and > will be the total and only compensation for the entire deal.

<comment><USER14> They are looking at companies that: "Raised under $10M total investment funds, last round being over 3 years ago"

This implies that in addition to self-funded ventures, they are looking for fire sales from failed start-ups.

</comment></comment></comment><comment><USER15> Semmle's post: [https://blog.semmle.com/secure-software-github- semmle/](https://blog.semmle.com/secure-software-github-semmle/).

</comment><comment><USER16> Github has been really working on their source code analysis toolkit recently & this acquisition makes perfect sense as part of that strategy. Congratulations to Oege & the team.

</comment><comment><USER17> First project I look up on lgtm.com is rust.. Second alert I find is this:

[https://lgtm.com/projects/g/rust- lang/rust/snapshot/f5aa590b...](https://lgtm.com/projects/g/rust- lang/rust/snapshot/f5aa590b8ca98e925e5b1b975d7aef07e0c7a028/files/src/ci/docker/scripts/android- sdk-manager.py#x2e8f6c458bb40362:1)

exist_ok is available from python 3.2, so this isn't a good impression.

[https://docs.python.org/3.7/library/os.html#os.makedirs](https://docs.python.org/3.7/library/os.html#os.makedirs)

</comment><comment><USER18> Huge congrats to Oege and the team at Semmle - couldn't be happier for a hugely passionate and smart individual (and a previous professor of mine!)

Am sure this will bring some amazing advances to Github and thus a huge % of the developer community.

</comment><comment><USER19> "Human progress depends on the open source community."

What a way to begin an article.

<comment><USER20> Especially considering M$ owns GitHub

</comment></comment><comment> tom-jh I've just tested their lgtm.com on our codebase:

1) identified str.replace('[ABC]+', '') correctly as a bug (looks like a regex but is string literal)

2) identified various unnecessary code that TypeScript overlooked

3) identified double-unescaping of html (this one would have probably gone unnoticed for years)

And a bunch of other stuff. No actual vulnerability in our case, but still very useful. I'm enabling their checks on every future PR.

This was TypeScript but they support the rest of our stack too (Python, Java). I wonder if this includes Kotlin - will try.

<comment> tom-jh Tested, Kotlin is not supported, nor is Swift.

</comment></comment><comment><USER21> > Human progress depends on the open source community.

(Non native speaker here). Am I misunderstanding something, or is the author explaining that humanity can not progress without the open source community?

<comment><USER22> That's right. That's called hyperbole (with a 'e').

</comment></comment><comment><USER19> I've used semmle's tools at Google, they seemed pretty powerful.

</comment><comment><USER23> I spent way too long thinking that Semmie was just a badass programmer

</comment><comment><USER24> Would be cool if the tools would be made open source in order for everyone to get more security.

</comment><comment><USER25> So this is the excuse they're using to build infrastructure to scan through everyone's code to find whatever they want.</comment>


Neil DeGrasse Tyson to Elon Musk: SpaceX Is "Delusional" About Mars - <AUTHOR> http://www.fool.com/investing/general/2016/03/27/neil-degrasse-tyson-to-elon-musk-spacex-delusional.aspx <comment><USER2> So, let's see: Elon says that to make Mars work financially, launch costs need to fall by 99%. That's about 100x more reasonable than the straw-man Tyson is beating.</comment>


Why Headless? - <AUTHOR> https://medium.com/@brookesargent/why-headless-ecommerce-2e3de6bc7295 <comment><AUTHOR> We're debating this internally at work, ad nauseam, and one of our engineers put together this post on why. Just in case others are having the discussion. There are merits on both sides. I think it's particularly hard for talented devs to want to work "with a template". But, as we look to serve the business, what is the RIGHT answer?</comment>


The Day Google Decided HttpWatch Was 'Unwanted Software' - <AUTHOR> https://blog.httpwatch.com/2015/04/20/the-day-google-decided-httpwatch-was-unwanted-software/ <comment><USER2> >Simtec: How come there isn't one here? [https://www.google.co.uk/chrome/browser/desktop/](https://www.google.co.uk/chrome/browser/desktop/)

>Google Support: Lol

>Simtec: No really?

>Google Support: That's a great question

This is the most telling part of the conversation to me. Not just for the hypocrisy others have mentioned, but for the attitude of the Support rep that it reveals. The rep feels so powerless and so disconnected from their own company that a resigned laugh is their first response to an inconsistent rule.

The few companies that manage to have mostly excellent support folks are the ones that:

1\. Keep the support guidelines clear and sensible, and more importantly 2\. Give the support folk the power to make internal changes (or at least to start discussions) when they _aren 't_ sensible or consistent.

Amazon has done very well along these lines, while Google apparently still doesn't trust Support enough to do this.

<comment><USER3> If that's a full and accurate transcript; then there's a lot of things deeply wrong with that.

If you pay a company over a million dollars in advertising fees, you'd expect a phone call prior to service cancellation. And you _damn sure_ wouldn't expect a chat window analyst to say "lol" to you when you pointed out their own hypocrisy. I know they like young employees there, but are they staffing their customer support team with teenagers now?

I get sense of humor, but there's a time and a place. A customer just had their account blocked, now's not the time to be anything but apologetic. Customer Service 101 stuff here.

<comment><USER4> > If you pay a company over a million dollars in advertising fees, you'd > expect a phone call prior to service cancellation. And you damn sure > wouldn't expect a chat window analyst to say "lol" to you when you pointed > out their own hypocrisy. I know they like young employees there, but are > they staffing their customer support team with teenagers now?

The great thing about Google is that they don't just treat the end users with contempt - they treat the paying customers with _the same_ contempt!

(seriously, try getting support for a paid-for GApps problem)

<comment><USER5> Same stuff goes with Google Cloud which Google advertises as "business oriented". We had a $20/month project that for some reason its billing account became invalid. It was the first week of the month, billing is at the end of the month, they could just ask us to fix the issue.

Instead they chose to suspend all our projects on Saturday morning, despite paying them more than $10,000/month for the rest of the projects —which had no billing issues.

We found out when all our external service monitors went crazy. Google emailed us a couple hours later and didn't restore our projects until Tuesday.

Extra credit should be given for when they informed me that they turned my personal, non-commercial / developer account to a business account because "google cloud should only be used for business".

</comment></comment></comment></comment><comment><USER6> This recent Google "crackdown" was making rounds in shareware circles.

Basically, a shareware vendor will have their AdWords account suspended with some harsh wording and the stated reason would be that the website doesn't have either (a) uninstall instructions _next to the download button_ (b) terms and conditions _next to the download button_ (c) the software is of "unwanted" type (d) some other random thing (that was A-OK before) not being quite up to sniff. All in all, it looks just some random nitpicking that will go away only if the matter is escalated, which takes several weeks to process. The general sentiment seems to be that Google no longer gives a flying f*ck about smaller AdWords customers and/or some run-away manager is basically having a field day with enforcing arbitrary clauses of their AdWords T&C.

What's going on in reality - nobody knows because of how "open" and communicative on the issue Google is.

<comment><USER7> Before Google's new terms for software AdWords, it was extremely common for scumbags to wrap freeware or OSS in spyware and buy ads for the software's name. Users would click what looked like the first result, land on what looked like a legitimate download page, and end up with something ugly like Conduit.

I'm the "computer geek" for some friends and family, so I've fixed up a good number of PCs, and AdWords has been by far the #1 vector for malware. A lot of people in my position just started installing ad blockers on every PC they work on, to save trouble later. Google's new approach has a lot of problems, obviously, but they're not just power-tripping.

<comment><USER8> So instead of punishing the people who eg wrapped vlc in spyware, they decided to screw over good actors? I think the clear difference is the wrong thing was easy for google to do (though unlikely to actually help at all -- nobody reads eula or uninstall directions), and the right thing -- directly targeting the bad actors and booting them from adwords -- would have taken work and money.

Yet another reason google is untrustworthy.

<comment><USER7> The spyware ads have disappeared for me. Do you still see them? Google's actions were too broad, but they seem to have been effective.

</comment></comment></comment></comment><comment><USER9> Given the fact that Google don't follow their own guidelines (I checked their desktop and android download pages) it would be interesting to hear the EU competition commission's point of view given their current objections to Google's behaviour regarding adwords.

<comment><USER10> I just checked the Chrome desktop[0] and Android SDK[1] download pages, and both do follow the guidelines - clicking on the download button reveals the EULA which the user must agree to prior to downloading the software.

[0]: [https://www.google.co.uk/chrome/browser/desktop/](https://www.google.co.uk/chrome/browser/desktop/)

[1]: [https://developer.android.com/sdk/index.html](https://developer.android.com/sdk/index.html)

<comment><USER11> For the Android page, however, you could argue that they don't follow their own guide lines.

Click "Other download options". The EULA dialog only appears if the user clicks the link with his left mouse button as it seems to be a purely client- side interception. Should he, however, use right-click->save as or open in new tab he is not presented with the dialogue.

</comment></comment></comment><comment><USER12> I'm actually surprised they ended up getting a successful outcome, given the hostile tone they took with the support person. Being hostile is usually a great way to get a "sorry, can't help you" response.

<comment><USER13> That doesn't sound like a terribly hostile tone. Yes, there was a little bit of hostility, but nowhere near the level that would lead a support person to give up on helping you.

Remember, people in support are used to a somewhat hostile tone. People get in touch when something is wrong, and so it's fairly common for people to be frustrated. If they just responded with "sorry, can't help you" to every support query with a slightly hostile tone, they wouldn't be providing much support.

And yes, it is also good to try and assume good faith and not vent your frustration at a support person who had nothing to do with whatever issue it is that you're frustrated about. But it's a fact of life in support that you'll have to deal with some unhappy people, so you need to be able to deal with it.

<comment><USER14> > Remember, people in support are used to a somewhat hostile tone.

My experience is that support personnel often get worn out by so many hostile interactions and become more reactive to them.

<comment><USER15> and that's the difference between someone good at the job and someone average.

</comment></comment></comment></comment><comment><USER16> For future reference; being a dick to the guy in support trying to help you doesn't really do much to help the situation. It typically only results in you getting less help - nobody has the desire to go the extra mile for someone who starts out with that kind of tone.

I get you're mad at "google", but taking it out on an employee tasked with helping fix your issues is kind of like being an asshole to a waitress...

<comment><USER17> But you have to realize that at Google, that person is your only point of contact.

Making your displeasure known to at least 1 person who works there gets your message across better than sucking it up and letting them think it isn't really such a big deal.

<comment><USER18> That's only if the support rep has any way of passing the information that the client was displeased up the chain. I find that unlikely.

<comment><USER17> Unlikely is better than nothing, that's my point.

</comment></comment></comment></comment><comment><USER19> Yet another sign that Scott Locklin was dead-on about Google having become Fat Elvis:

[https://scottlocklin.wordpress.com/2011/02/04/google-as- fat-...](https://scottlocklin.wordpress.com/2011/02/04/google-as-fat-elvis/)

And yet, none of the contenders for the throne can deliver the same level of search quality.

I find this frustrating because I hate Google for its A/B testing and blind- allocated mediocrity, and yet, everything else continues to be worse. It's like being married to someone you truly despise (at least for me, your mileage may vary).

I really don't get why no one can disrupt them. But clearly they can't...

<comment><USER20> > _And yet, none of the contenders for the throne can deliver the same level > of search quality._

YMMV, but I have been using Duckduckgo exclusively on my desktop and smartphone for half a year or so and the rare times I used Google (with "!g" prefix) during that time, I could not find better search results there either. So for all common purposes, DDG fully replaces Google for me (and I'm not a novice user who cannot tell, I've been using the web obsessively for ~20 years [and yes, AltaVista before Google]). Perhaps you should dare switch to DDG for a while and see if the illusion, that Google works better in some unspecified way, disappears.

<comment><USER21> I've got 2 problems with DDG:

1) The results I get in DDG are the same results I get in Bing - which means that DDG is for me just a shell around Bing. And even though DDG is not sending to Bing any cookies with my ID, well, being a power user I can and do use the Incognito/Private mode of my browser. Furthermore, your interests can function like a digital fingerprint, so if Google or Microsoft want to identify you without any cookie whatsoever, they can and DDG does not help.

And the bang shortcuts of DDG are also provided by my browser. I mean, if I'm concerned with privacy, why in the world would I want to send my Google searches to DDG's servers?

2) People saying that DDG's search results are just as good are probably living in the US. Outside of the US, like in Europe, non-Google search results get to be like really, really bad ;-)

<comment><USER20> > _DDG is for me just a shell around Bing_

I can't comment on that because I don't use Bing. Perhaps Bing would suffice as a Google replacement then? The "instant answer" type results from DDG probably do not work with Bing.

> _Furthermore, your interests can function like a digital fingerprint, so if > Google or Microsoft want to identify you without any cookie whatsoever, they > can and DDG does not help._

How would that work if GA is blocked and "!g" is used only rarely? Also, I use Tor and DDG is the only search engine that doesn't annoy me with captchas (Google's seem totally broken, often I need to solve multiple captchas for a single query - I wish people would stop linking to Google searches...).

> _People saying that DDG 's search results are just as good are probably > living in the US._

No, I live in Austria. I recall complaining about search results about the time the "filter bubble" experiment by DDG ran, but the situation has greatly improved since then.

</comment></comment></comment></comment><comment><USER22> This kind of stuff could easily be resolved by including a specific and complete list in the first place.

Telling someone they aren't presentable isn't the same as telling a mostly well dressed person that the host wants them to wear dark socks with their dress shoes instead of white socks. (Hopefully this analogy is fitting.)

<comment><USER23> Fashion is a matter of taste, isn't it, and ultimately as void of real meaning as the renderings of the "Opinion of Google"? I suppose perhaps your analogy fits more well than you perhaps expected, but not in Google's favor.

</comment></comment><comment><USER24> I wonder if Google takes reports about Google pages not following their polices seriously. Also I wonder if the same guidelines apply for major software websites, I don't think download.com follows most of these requirements.

<comment><USER8> Submit your report to the european anti-trust commission.

</comment></comment><comment><USER25> The funnier part: Google is listed as one of their customers on their home page! [http://www.httpwatch.com](http://www.httpwatch.com)

</comment><comment><USER26> I find the hypocrisy especially interesting given that a few years they demoted Chrome for breaking a paid link rule. It certainly seems like this is another blatant broken rule by the Chrome team - not that it's their fault because they were probably never told about the rule either.

</comment><comment><USER27> couple of years back, adwords suspended my account.

the only response i wrote back was, I have no intentions either, of paying my money to a company that has little to no respect to its customers.

I got back instant response and got my account reinstated, but, still I didn't agree, I asked him, I need written apology from the head manager, the support person apologized for this, and said the head manager is traveling overseas. So I accepted.

I never asked the reason why they did it in the first place. I was just furious, you don't say fuck off to your customers, without first talking to them.

</comment><comment><USER28> Those Adwords support folks make like $10 an hour and are employed by third parties.

I'm surprised you had a good resolution.

</comment><comment><USER29> A great example of Google "Do as I say, not as I do."

Re "How do I uninstall this?" Google Cloud Print appeared to be, at least on Win XP a couple of years ago and when set up to share a non-Cloud-Print-native printer, a one-way process. That borked non-Cloud printing (how the printer used to work; functionality that was desired to continue) pretty thoroughly.

I like a lot of things about Google and their products. However, lack of communication on topics such as these more than borders on arrogance.

P.S. OT, but: And _where_ is Lolipop for my 2013 Moto-X (then a Google product) from Verizon. I bought it in good part because, unlike other Verizon mobile products, timely updates were "promised" strongly as part of the marketing and promotion. (And yeah, I need Verizon for specific reasons...)

Now? Bupkiss. With the better part of a year left on my two-year contract (that I entered hesitantly but again, at least with this "promise" as some comfort/reassurance).

Google is enormously selective in their "support" and not infrequently refuses to go out of their way when it does not support the initiative du jour.

(E.g. but not only nor primarily, insisting the pressure stay on Verizon to apply these updates.)

</comment><comment><USER30> I have a rather ominous feeling that the removal process was triggered by automated scanning picking up certain keywords like "sniffer". In today's environment of security paranoia, unfortunately it's not hard to imagine something like that being interpreted the wrong way...

Also, I think "unwanted software" is a bit opaque; what they really mean is software _Google_ doesn't want, not necessarily the user.

</comment><comment><USER31> From the title I expected a piece about how this affected their business. Graphs showing downloads before, during and after; etc.

</comment><comment><USER32> Any kind of monoculture is simply a terrible thing.</comment>


Gracefully exiting from console programs in Ruby - <AUTHOR> http://futuresimple.github.com/posts/2012-02-24-graceful-exiting-from-console-programs-in-ruby/

<comment><USER2> This looks like a cool technique, but what happens if the process gets stuck in a loop somewhere (maybe in third-party code, or waiting on I/O) where you can't put calls to the check method in? Maybe it'd be a good idea to check to see if the flag is already set in the handler, and immediately exit in that case. That way, hitting ctrl-C once would cause a graceful shutdown, while hitting it twice (which is a pretty typical reaction if the first doesn't cause a quick exit) would force-quit in emergencies.

<comment><AUTHOR> Great point - something like this?

<https://gist.github.com/2038115></comment></comment>


Cargo Cult Game Design - <AUTHOR> http://bhargreaves.com/2010/04/cargo-cult-game-design/

<comment><USER2> A few associations: I was first introduced to the "cargo cult" idea through Feynman's commencement speech (<http://www.lhup.edu/~DSIMANEK/cargocul.htm>). Also kind of related is PG's idea of nth-degree imitations (<http://www.paulgraham.com/love.html>).

</comment><comment><USER3> Some examples would have been nice.

<comment><AUTHOR> followup post, perhaps. :D

</comment></comment><comment><USER4> As a game developer, I'm accustomed to building games around game mechanics. It's often a struggle to convey the importance of strong core game mechanics when they are not visible like beautiful art or animations. This article makes it clear that adding game mechanics as a (problem solving!?) wrapper to a non- game is akin to adding (problem solving!?) graphics to a game.

Nevertheless, I think that parallel can extend further in ways that might soften the article's point (just as the author did at the end). Some game design components, like clear state feedback and reward, are not so much game mechanics as they are signals of the mechanic's state (usually done with art in its general sense). In the same way, those signals could be incorporated into non-games to reflect the internal workings of their state.

So, in the end, I agree with the article and think it provides an insightful lens through which to view the parts of games relative to more tradition software.

</comment><comment><USER5> But copying successful stuff without understanding it is the whole point of evolution!

</comment><comment><USER6> The "comments" section which mixes all kinds of mentions from the Internet including twitters is really annoying.</comment>


How foreign investors launder their money in New York real estate - <AUTHOR> http://theweek.com/articles/736313/how-foreign-investors-launder-money-new-york-real-estate <comment><USER2> The headline asks a question, but the article doesn't answer it. More generally, shell companies don't always launder money.

I suppose shell companies could be barred from buying residential real estate, but residency requirements proposed are ludicrous - the whole 8 month occupancy clause, for instance. What if I want to spend 6 months in SF?

<comment><USER3> If you have enough money to outright purchase residential real estate in San Fransisco, just to use it for 6 months, you are exactly the person being targetted

<comment><USER2> You make it seem criminal to own homes in NY & SF. It's unconstitutional to restrict the right to property.

</comment></comment></comment><comment><USER4> See also: Vancouver

<comment><USER5> Vancouver real estate doesn't look expensive enough for me to suspect money "laundering" at scale. It looks more like a capital offshoring effort by wealthy but not ultra wealthy mainland China citizens.

NYC and London meanwhile have perfect vehicles for this since so many properties are mid 8 figures.

For the Bay Area, I'm curious what the numbers would be like for Atherton / Woodside homes and SF luxury highrise condos.</comment></comment>


Pi-based BBC Micro Co-Processor - <AUTHOR> http://stardot.org.uk/forums/viewtopic.php?f=3&t=11325 <comment> david-given For background, in case anyone doesn't know (huh, I was just discussing this here last week)...

The BBC Micro Tube interface is a fast interface which allows a second, quite different computer to use the BBC Micro as an I/O processor. Acorn made several: the most popular was a 3MHz 6502, but there was also a Z80 model which ran CP/M, a NS32016 with 1MB RAM which ran a custom OS, the famous ARM1, etc.

The second processor communicates with the BBC Micro via RPC, and can make any system call. The BBC Micro provides graphics, filesystems (including hierarchical disk and network filesystems), printer, keyboard, etc, all in a completely portable fashion. (The BBC Micro operating system was really rather good.) This keeps load on the second processor down. No I/O interrupts, no need for drivers, no real need for an OS if you don't want one; the 6502 second processor had a 2kB ROM and everything else in the address space was user RAM.

It looks like what this is doing is bit-banging the BBC Micro Tube interface and emulating a 6502 in software, so it's _pretending_ to be a classic 6502 second processor (rather faster than the original!).

Here's a different project:

[http://www.stardot.org.uk/forums/viewtopic.php?f=44&t=8852](http://www.stardot.org.uk/forums/viewtopic.php?f=44&t=8852)

It's an FPGA-based second processor module which (if I read it correctly) can be programmed with a soft core to be a 6502, 68000, 6809, Z80, 32016 or PDP11 second processor. Some crazy person seems to have even ported BBC Basic to the PDP11...

<comment> david-given ...also, hey, look: you can buy a new ARM7 coprocessor!

[http://www.sprow.co.uk/bbc/armcopro.htm](http://www.sprow.co.uk/bbc/armcopro.htm)

It runs a minimal RISC OS workalike, just enough to run BBC Basic V. All this for a mere £88!

</comment></comment><comment><AUTHOR> The project's wiki might actually be a better link: [https://github.com/hoglet67/PiTubeDirect/wiki](https://github.com/hoglet67/PiTubeDirect/wiki)

</comment><comment><USER2> Okay, but what's the purpose of this? Is it merely proof of concept work? Are there software that could utilize a 100 MHz BBC Micro? Or is just something incredibly cool for BBC Micro fans?

<comment><USER3> Well... I think that the 'beeb' was hands down the best machine ever to learn how to program on.

It would be nice to see a re-vamped version of it and the 'pi' has all the bits and pieces. Hopefully this is the prelude to something along those lines that no longer needs a bbc micro as an io front-end. (Though, it would seem that doing that right out of the gate would be simpler than to use the original bbc so probably this is to satisfy an itch.)

</comment></comment><comment><USER4> My dad has a second processor in his loft, along with every other BBC (but not the Master Compact) and Acorns after that, plus no Electron (who would have one of them??)

Happy days spent using those things. Running Elite with a second processor did hidden line removal!!

<comment><USER5> We have/had an Electron, why wouldn't someone have one? (Not arguing, just curious.)

<comment><USER4> Only because of the perceived poor value of it in comparison to Beebs on the market at the same time, I thought?

Was there a difference in the BASIC implementations or am I imagining that?</comment></comment></comment>


Zulily: A Billion-dollar E-Commerce Company You May Know Nothing About - <AUTHOR> http://www.fastcompany.com/3041404/inside-zulily

<comment><USER2> Really interesting to contrast their story with Fab (as mentioned in the article) as they do seem to have started at a similar place and then just diverged so strongly.

In the context of the BusinessInsider piece on Fab that was on HN today this quote was actually kind of chilling: "When you look at Fab or some of the other things that got started and flamed out, I think there's a lack of cost control," Vadon offers.

</comment><comment><USER3> I know all about it:) Have been a customer for 1+ years - a bit addictive...

<comment><USER4> I was going to say the same thing. I suspect my household has spend a couple grand there over the last couple years, particularly on kids' clothes & shoes.</comment></comment>


A Message About Vanguard From Our Security and Privacy Teams - <AUTHOR> https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams <comment><USER2> Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software.

As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected terrorist's computer. No need for privilege escalation when you can just ask the user to install it at ring-0.

<comment><USER3> All software that you install on the main desktop operating systems is given the "keys to their computer kingdom": there is no privilege separation or sandboxing, except for the "user vs root" division, which can be trivially bypassed in countless ways (and anyway, most installers require root privileges).

And yes, obviously you need to have a dedicated gaming PC and certainly not install any games or any software that isn't strictly necessary on the systems/VMs with important data.

<comment><USER2> To some degree that's true. I keep an eye out for programs that insist on running as root. And if someone breaches my account, they've still got to put the work in to escalate their privilege through one of these programs.

I've also been installing more and more software into ~/bin rather than the more traditional /opt and /usr/local/bin. I think that the trend towards usermode software will take over in the next five years.

<comment><USER4> Usermode software might be far more dangerous though. Any software you run on your machine can change the files in ~/bin, and you won't know the difference.

</comment></comment></comment></comment><comment><USER5> >we wouldn't work here if we didn't deeply care about player trust and privacy

Bold message from a chinese company. People freak out about Huawei but Tencent is 1000% worse. And here they are installing a kernel driver on your PC.

<comment><USER6> This is being downvoted, but this is an important point. The Chinese government has repeatedly shown they'll work with Chinese companies to carry out the government's agenda.

Do you really think that after 100M people install this kernel driver that the Chinese government won't lean on Tencent to gain access, or use it beyond its original purpose?

<comment><USER7> So let me ask you a question then..

Do you feel the same way about Microsoft and Apple, and every other company that provides a hardware driver for a modern computer, and whether state governments (USA included) put pressure on them to let them advance their agenda by using back doors in their drivers or software?

Why is Riot special in all this? What, in your view, makes them more likely to be so secretly and so deeply corrupted in the manner you suggest?

Note I'm not asking you if you run MacOS or Windows.

<comment><USER6> Your argument boils down to, "If one country has access, then every country should have access."

I don't agree with that.

It's clear the US has backdoors. That doesn't mean it's wise to invite China to add backdoors as well.

<comment><USER7> I am not arguing anything, and would never say anything that ridiculous.

I just find it tedious and irrational to see people up in arms about this contrived and unlikely scenario (a video game company is going to spy on you - a random nobody - for a big bad foreign power), while _not_ being up in arms about the much bigger and more likely vectors of compromise they are exposed to constantly (like your operating system or cell phone).

But of course protecting yourself from those possibilities would require real sacrifice and inconvenience, so let's not talk about it.

<comment><USER6> You've thrown out two, new arguments:

1\. "Nobody playing this game is important enough to be spied upon."

It might surprise you to learn that some people in the military, congress, the DoD, and even important individuals in significant companies play video games.

2\. "Some vulnerabilities exist, therefore any new vulnerabilities should be ignored or not discussed."

All vulnerabilities should be considered, especially new ones that will affect 10s or 100s of millions of people. That's why we're discussing it. Since you find it tedious, you're free not to participate.

<comment><USER7> I'm not sure if you lack comprehension, or if you are just really paranoid and can only see things in absolutes, or if I'm writing poorly. But yet again you've taken what I've written and somehow twisted it into something ridiculous.

> It might surprise you to learn that some people in the military, congress, > the DoD, and even important individuals in significant companies play video > games.

Anyone in this scenario who is using the same computer to run _any_ untrusted software (like all games) as they are using for their national security work is already compromising themselves.

> "Some vulnerabilities exist, therefore any new vulnerabilities should be > ignored or not discussed."

This would be a more productive conversation if you addressed my points at face value, and made your own without twisting my words into whatever convenient position you want to argue against. That's the part I find tedious.

Everything is degrees.. you seem to only be willing to consider extremes.

Of course if you work in a sensitive position or are a likely target of foreign spying, you should take many more precautions. But that's not most people, in fact that's _almost no one_ , statistically speaking. So if we're going to discuss _likely_ compromise scenarios, the risk-reward on using a high-profile video game company as a vehicle for APT state-level actions starts to fall into "movie plot" territory, in my opinion.

And I never said that new vulnerabilities should be ignored or not discussed . Again, possible <> plausible.

In fact, you are basically contradicting yourself at this point because I first brought up _way more plausible_ vulnerability scenarios (your underlying operating system being compromised) and you dismissed that in favour of some narrow and much more implausible scenario (a US-based video game company as a deep-state plant for a foreign government).

Keep moving those goal posts..

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > ...some of you want to know more about the tech behind Vanguard. We can't > get too deep into the technical specifics without potentially compromising > Vanguard...

That in itself tells me enough about the efficacy of the system. Security through obscurity is only a hand wave of security. Making the trade off of all the security architecture put in place over the past decades for something that needs to be hidden to remain secure is a really poor value statement.

I understand why they want this in place, it does raise the level of effort on cheating but there are other ways this can be accomplished without compromising a user's security.

</comment><comment><USER9> The inherent issue with anti cheats as compared to anti-virus software is user intention.

A user who installs a anti virus program wants that program to do its job and find bad actors. The virus on the other hand is completely unwanted by both the user and the software- Its existence is threatened by all fronts.

However, a anti-cheat lives in a extremely adversarial environment. The cheater (and the cheat) wants the cheat on its computer. As such, the user will be willing to do extra steps to assist the cheat. This makes the anti- cheat software in this case, the 'un-wanted' virus, so it has to exist in the most hostile of environments and somehow detect programs which have higher privileges than itself.

That said, Cheating is something that will not go away. Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. It involved a second computer, which man-in-the-middled all network data to the client computer. This second computer then would display a 'radar' of where enemies were. As the anti cheat would have no possible way of knowing the existence of this second computer, there was not much they could do.

If you wanted to get more aggressive with the system above, you could have that second computer modify outbound requests as well. So if you shoot your gun and it would have hit the ground, it will now instead shoot a enemy in the head- as such even something like a aimbot is entirely possible with this setup.

However, there is indeed a anti cheat which can detect all known cheats and its basically what Valve did/does for CS:GO - Allow users to report suspected cheaters and then have the community analyze the reports. This catches all blatant cheats, but unfortunately will never get rid of radar/esp cheaters, only aimbots and the like.

Honestly, it sounds to me like there is a business model in the above. Years ago we had companies like evenbalance/punkbuster, easy anticheat, etc.. which provided software based anti-cheat systems. As you would expect, most would by bypassed and a daily cat and mouse game would ensue. The solution imo is to create a SaaS where you essentially provide a reporting + monitoring tool. Users of your game can report suspected cheaters (which includes the demo file / vod / replay / whatever) and your trained wet-ware staff would review all reports and take action where necessary. No invasive software necessary. Actually, no software on the end users computer at all would be necessary- It is all done on another users PC.

In fact, if someone is interested in doing the above, hit me up. Sounds like a easy win.

<comment><USER10> > Years and years ago, I developed with a friend of mine a completely > undetectable cheat for all games on the HL2 platform.

> It involved a second computer, which man-in-the-middled all network data to > the client computer.

Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?

<comment><USER11> In order for your game to render other players you have to know their position, so the game server has to send them to all players.

As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or close by. This limited the way that wallhacks work, it's not possible to see where players are from far away :)

What needs to be done is reverse engineer the communication protocol. If encryption is made, some kind of key to decrypt has to be somewhere in your game client. Then you can convert 3D coordinates to 2D and even draw a radar on your smartphone if you make an app.

<comment><USER12> >In order for your game to render other players you have to know their position, so the game server has to send them to all players

I know nothing about game engines, but I have always wondered why is that the case. The server could compute visibility and only send the opponent position if there is a chance the player might see it. Computing visibility server side is not cheap, but it would still be significantly cheaper than fully rendering a scene, right?

<comment><USER13> Riot's Fog of War for Valorant does exactly what you describe.

[https://technology.riotgames.com/news/demolishing- wallhacks-...](https://technology.riotgames.com/news/demolishing-wallhacks- valorants-fog-war)

</comment></comment></comment></comment></comment><comment><USER14> I skimmed, but it seems none of this addressed why the service (edit) runs at boot-time? Also, expecting a service to not not look at your data if they have access is not security.

If Valve can mitigate hacking in CSGO without such an intrusive service, I am sure Riot can. I, myself, did a very, very, very poor job with an autoencoder to detect anomalous matches in Dota and caught a large amount of players abusing the system. As far as I know, CSGO anti cheat does involve an ML component.

My point is that a non-intrusive anti cheat, advanced analytics, and tracking of user feedback goes a long way.

Ofc, none of this matters. If the playerbase actually cared, they'd boycott or stay away. And I cannot remember the last time gamers ran a successful boycott campaign.

edit: Also read that uninstalling the game will not always uninstall the ring 0 anti cheat. I can't verify since I would never install this on my system, but for what it is worth: That is terrible IF true.

<comment><AUTHOR> Hackers in standard CSGO games are rampant from what I understand.

Serious players pay extra to queue up in a dedicated service for high tickrate servers and anti-cheats which I believe are rootkits as well.. not sure about any of this though.

<comment><USER14> rampant years ago. It took a long time to get where it is now. There are still cheaters here and there, but that is to be expected, and relatively rare in my experience.

<comment><USER15> It is absolutely still rampant. I could count at least 5 cheater encounters in the last 30 days (blatant cheaters, btw).

They try their best to isolate cheaters with a "trust factor" system but the reality is, unless you pay an external service with their own anti-cheat software (that's probably as bad as Valorant's) you will get a high amount of cheaters.

Given they have zero transparency on the trust factor system, I could have a lower factor than you (I definitely rage too much), so because of it I see them more often. But there's no way to know if I'm in the cheater bubble, or you're in the no-cheater bubble.

<comment><USER14> I agree that it could be more transparent. I haven't faced a single suspicious player in quite some time (and similar with my friends that I talked to about this since this came up). Sorry that your experience is worse. Player "toxicity" should not be involved in this since it might be used as a proxy.

</comment></comment></comment></comment></comment><comment><USER16> League of legends is a real pain in the ass to play even when you're doing everything right. Personally I don't even like the game, it's just popular so I played it to hang out with friends. The way their launcher handles updates is crazy inefficient and so it always takes _hours_ to launch if it launches at all. It also runs terribly in wine.

<comment><USER17> ...Hours? The longest update I've ever had for League of Legends (in the ~6 years I've been playing casually) is about 20 minutes. And I'm on Mac—not exactly the high-priority platform for them.

Since they changed their launcher system a few months ago, it's been unusual to have to wait more than ~2 minutes for a new patch.

<comment><USER16> That's true if you update often.

If you're like me and only played occasionally the updates would build up and take very long.

</comment></comment></comment><comment><USER18> Whenever I hear/read lots of words about how secure something is and how strong their commitment to security I think "they don't know what they don't know".

<comment><USER2> We should all admit that we don't know what we don't know. But the default behavior afterwards should be to assume that the software/system is insecure, fixing the defects we can find and surrounding in by rings of moats (defense- in-depth). When you don't know what you don't know and then declare it to be secure, there's an extra layer of indirection and perhaps a bit of hubris.

</comment></comment><comment><USER19> I was concerned about the index funds for a moment...

</comment><comment><USER11> This will always be a cat and mouse game. There are some anti-cheat software more intrusive than others. Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM.

Most anti-cheats also scan all processeses memory and even files to detect know cheat signatures. They tend to run with high privileges and some take in- game screenshots for analysis. Basically they have permissions to do anything and receive silent updates.

I wonder if statistical methods to detect cheaters result in too many false positives.

<comment><USER20> > Even Valve Anti-Cheat (VAC) which is considered by many to not be very > intrusive, used to intercept DNS queries to detect communication with paid > cheats DRM.

I was surprised hearing this. It seems like what they actually did was if VAC already found something, it checked the hashes of the contents of the DNS cache against a list as a second check. That's quite a bit different from "intercepting DNS queries".

Overall VAC always made a reasonable impression on me as far as privacy and security are concerned (no SYSTEM services, no kernel driver, no screenshots, no scanning and uploading random files etc.), although this non-intrusive approach naturally limits the kinds of cheats it is able to discover. I feel like the approach taken by Vale is, on the whole, well balanced.

Source: [https://www.pcgameshardware.de/Steam- Software-69900/Specials...](https://www.pcgameshardware.de/Steam- Software-69900/Specials/Steam-VAC-soll-DNS-Cache-ausspionieren-1109977/)

<comment><USER11> Yes, thanks for clearing up the intercept part, I didn't remember how they did it exactly. They do make right decisions in my opinion to balance security/privacy issues at the cost of less ability to detect cheats. I think they also have a pretty good record of not banning inocent people.

</comment></comment></comment><comment><USER21> If people want to play games in anti-cheat environments, the only sensible solution I can see involves the reinvention of the cartridge.

In this case, make the cartridge a bootable SSD which entirely avoids touching any other disk in the system (perhaps with the exception of an SD card or USB storage stick for saves.)

The downsides include:

\- the game company now has to ship a complete OS and do hardware support. They nearly have to do that anyway, so whatever.

\- you'll need to reboot your computer for each game.

The upsides, I think, are obvious.

<comment><USER7> The other option that is touted a lot is cloud gaming, with services like Stadia.

There are outstanding issues to resolve there, like input lag and visual fidelity, but it certainly removes the ability to cheat at the system level by hooking into game processes and memory.

Aimbots would be still be theoretically possible through MITM video feed analysis (as has been speculated) but that would also work in your cartridge scenario.

</comment></comment><comment><USER22> yeah, a chinese company will gain root of your pc to stop you from tampering with memory but it's totally fine guys don't worry

</comment><comment><USER23> Potentially dumb question: how do cheats even work in a game like LOL? I understand aimbots in a FPS and how they can give a pure mechanical advantage, but the LOL equivalent isn't obvious to me. Does the client have access to data that's not supposed to be exposed to the player?

<comment><USER24> Aimbots work in LoL too, there are champs that are balanced around lots of skill shots (Xerath) who you'd see hitting every single shot all game. There's also a lot of scripting, both for account leveling or just to automate boring parts of the game. You'd see people afk playing their lane for 20 mins and not responding to anything happening in the game, then suddenly running into the other team for a big fight.

</comment></comment><comment><USER25> As someone who mainly deals with web services, this all seems really weird to me. I was told from very early on "never trust the client". There was a lot of emphasis on server-side validation; client-side validation was only ever for UX, e.g. highlighting the field in red instead of making the user submit the form first.

Reading through this, it seems the game development world is doing the exact opposite and pushing all the "security" measures to the client. Is that incorrect? If it's correct, does anybody have any idea why?

<comment><USER26> You're a bit out of your depth. Of course "trust the server" is preferred but many forms of cheats are purely client side. For example an aimbot that steadies your cursor on someone's head or dodges automatically when a projectile is inbound. Maybe the client hijacks the UI to hide terrain and walls.

I'm not saying what valorant has done here is right, there are other things you can do. But you're oversimplifying the problem.

<comment><USER25> I understand that but it feels like there's a lot of focus on client-side anti-cheat while cheats that should be trivially detected server-side still exist (like flying through the air in a game where that shouldn't be possible).

Plus, there seems to be a lot of focus on client-side anti-cheat when a lot of it could be addressed server-side:

> For example an aimbot that steadies your cursor on someone's head or dodges > automatically when a projectile is inbound.

This sounds like a similar problem to "like" fraud and things like that. Couldn't it be addressed by measuring the number of incidents? If someone is able to headshot or dodge at an abnormal/superhuman level, that can be detected server-side and the user banned (or flagged for human review).

> Maybe the client hijacks the UI to hide terrain and walls.

Someone mentioned a solution for this elsewhere in the thread: don't send positions of important resources to the client if it doesn't need them. Keep the client about as blind as the player.

And again, you should be able to detect this server-side. If somebody has an abnormally high kill-rate for enemies coming around a corner, flag them for review.

<comment><USER26> Humans can and do in fact do all the things you suggest. False positives are generally to be avoided, and mitigations for reverse engineering are still required (anti debuggers, anti dll injection measures).

All the stuff mentioned like not sending positions of people who aren't visible are typically already done, but sometimes the position is needed for reasons you don't understand. Like some gameplay ability to suddenly see through walls, etc.

This thread just has a lot of backseat programming.

I think I would find your post a little less irksome if you approached it from a neutral questioning tone as opposed to "what about these obvious things every junior engineer learns" :/

<comment><USER25> I'm not trying to condescend or be a backseat programmer, I apologize if my tone suggested otherwise. I know that I have no idea what I'm talking about and I know that there are plenty of competent game developers in the industry.

The problem is that I don't know what I don't know, so I can't directly ask it. The best thing I can do is to present the flawed results of my current understanding so that somebody more knowledgeable (such as yourself) can tear them apart and show me what it is that I'm missing.

> False positives are generally to be avoided

This sounds like the biggest difference to me. Generally in my limited experience in handling abuse on web platforms, the value of a single user is so low that a false positive doesn't really matter too much.

I suppose when it comes to games, each user represents a ~$60 investment and potentially a lot of time and emotional investment, so a false positive can't be so easily tolerated and there's an incentive to go to extreme ends (like intense client-side validation) that wouldn't make sense for say Twitter likes.

</comment></comment></comment></comment></comment><comment><USER27> Also worth highlighting, Riot Games belongs to Tencent.

</comment><comment><USER28> Considering that client will always find a way to cheat, isn't it more logical to do all anti-cheat detection on server side? Gather data from trusted players during closed beta test and after launch just look for abnormalities on data coming from clients.

</comment><comment><USER29> Folks should build alternative clients for Riot's games. Riot has demonstrated that they should not be trusted to write clients.

<comment><USER30> That is a lot more effort than re-building the game, isn't it?

At that point, just make your own game, or easier yet, play another one.

<comment><USER31> I don't think it's a feasible plan, but there's probably some demand for that specific solution--people have friends who play riot games, so they want the ability to play those those specific games without the invasive anti-cheating software.</comment></comment></comment>


NET Core Data Access - <AUTHOR> https://blogs.msdn.microsoft.com/dotnet/2016/11/09/net-core-data-access/ <comment><USER2> One of the hardest things about using Core is finding compatible libraries. Giving a cheatsheet for viable data solutions is a step in the right direction.</comment>


Sen. Roy Blunt[R] admits he put the 'Monsanto Protection Act' Into Spending Bill - <AUTHOR> http://www.disinfo.com/2013/04/republicanr-oy-blunt-revealed-as-senator-who-snuck-monsanto-protection-act-into-spending-bill/

<comment><USER2> People love to blame actions like this on lobbyists but Monsanto is a popular company in some areas.

They employ a lot of scientists and the maintenance of their extensive labs, certifying HVAC and safety equipment, etc creates a lot of work for people in the St Louis area.

He was probably working closely with Monsanto on this rider but it's probably popular with many of the citizens he represents.

</comment><comment><USER3> This is pretty shiesty. I wonder if there is anything we (the american people) can do to change this type of behavior?

I honestly dont know what someone like myself can do to take action and have my voice heard.</comment>


Tesla stock burned by car fire video, downgrade - <AUTHOR> http://www.usatoday.com/story/money/cars/2013/10/02/tesla-fire-stock-falls-analyst-downgrade/2911345/

<comment><USER2> From Tesla:

"Yesterday, a Model S collided with a large metallic object in the middle of the road, causing significant damage to the vehicle. The car's alert system signaled a problem and instructed the driver to pull over safely, which he did. No one was injured, and the sole occupant had sufficient time to exit the vehicle safely and call the authorities. Subsequently, a fire caused by the substantial damage sustained during the collision was contained to the front of the vehicle thanks to the design and construction of the vehicle and battery pack. All indications are that the fire never entered the interior cabin of the car. It was extinguished on-site by the fire department."

<comment><USER3> Well now they cannot say that they have never had one catch fire. Which is probably great news for T-haters but only modestly interesting for the rest of us :-)

Would love to see a dump of the onboard diagnostics for that event.

<comment> shawn-butler Perhaps Boeing will offer their services with a healthy dose of snark? [0]

I would have guessed major municipal fire departments would have had more training extinguishing Class D Fires. Isn't water and lithium usually a Bad Idea? I recall seeing some US Navy surplus fire extinguisher canisters labelled specifically for lithium. I think they were based on copper reactions.

[0]: [http://www.digitaltrends.com/cars/tesla-ceo-elon-musk- offers...](http://www.digitaltrends.com/cars/tesla-ceo-elon-musk-offers- boeing-unsolicited-help-via-twitter/)

</comment></comment></comment><comment><USER4> Anything for a story.

Down 6% isn't a big deal for a volatile tech company like Tesla. They've plummeted to the same price they were trading at two weeks ago.

</comment><comment><USER5> Thing is, cars catch on fire [1]. I'm not really going to panic about TSLA stock until there is more evidence of it being an unusually high incidence rate.

[1] [http://forums.vwvortex.com/showthread.php?5139847-Worst- exot...](http://forums.vwvortex.com/showthread.php?5139847-Worst-exotic-cars- you-can-think-of).

<comment><USER6> I agree. FOD (Foreign Object Debris) at high speed can damage a car and cause a crash. Lets assume that a metal object on the highway hit the underside of this car; If that same object severed a fuel line or hit the gas tank of a conventional car, A fire could result.

</comment></comment><comment><AUTHOR> Here's the Jalopnik video mentioned in the USA Today article:

[http://jalopnik.com/this-is-what-fiery-tesla-model-s- death-l...](http://jalopnik.com/this-is-what-fiery-tesla-model-s-death-looks- like-1440143525)

</comment><comment><USER7> Seems co-incidental and not totally unrelated to the general panic in the markets this week as we near the debt ceiling deadline. I personally am quite bullish on Tesla.

</comment><comment><USER8> "All indications are that the fire never entered the interior cabin of the car."

Oh give me a break. I'm a Tesla fan overall but their PR is very manipulative sometimes. If you were stuck in that car you'd probably be dead from the heat of that fire. The guy in the video even said he could feel it from a hundred feet away. Good thing the occupants could get out.

</comment><comment><USER9> I've flagged this story because it just looks like someone is scaremongering so they can buy Tesla stock cheap. Isn't there laws against this sort of thing?

<comment><AUTHOR> I posted it because there's strong interest in Tesla and Musk on HN. Are all the positive stories only posted because someone is trying to increase the value of their holdings? It was in the news. I posted it. I don't have a dog in the fight.</comment></comment>


Project gating with Zuul - <AUTHOR> https://devup.co/zuul-a-project-gating-system-from-openstack-e3dd577a4e44#.dt2m5svmw <comment><USER2> Poor naming choice

[https://github.com/netflix/zuul](https://github.com/netflix/zuul)</comment>


API Hour Python asyncio framework - <AUTHOR> https://github.com/Eyepea/API-Hour

<comment><AUTHOR> According to this thread, the overhead over pure WSGI seems low:

[https://groups.google.com/forum/#!topic/python- tulip/AgKcuC-...](https://groups.google.com/forum/#!topic/python- tulip/AgKcuC-v7aY)

I'm wondering why the framework benchmark results are so different, even though they should include the same code:

[http://www.techempower.com/benchmarks/#section=data-r10&hw=p...](http://www.techempower.com/benchmarks/#section=data-r10&hw=peak&test=json&l=1kw)</comment>


US scientists significantly more likely to publish fake research, study finds - <AUTHOR> http://www.sciencedaily.com/releases/2010/11/101115210944.htm?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+sciencedaily+%28ScienceDaily%3A+Latest+Science+News%29 <comment><USER2> The glib response is "US scientists significantly more likely to _get caught_ ". (In related news, New York City's arrest rate for murder is likely higher than Kabul's.)

But, given that there is no attempt to adjust the numbers for the US' disproportionate representation in the universe of all published papers, even the glib response isn't correct.

<comment><USER3> The source says that 33% of withdrawn papers by US first authors were attributed to fraud, while only 25% of withdrawn papers by Asian first authors were attributed to it. So, US first authors are - comparing race cohorts - more likely to publish fake results, are they not (disregarding the fact that there is no possible measure of how likely it is to get caught)?

I agree, though, that the finding is pretty much useless.

Great article in The Atlantic btw - "Lies, damned lies, and medical science" [http://www.theatlantic.com/magazine/archive/2010/11/lies- dam...](http://www.theatlantic.com/magazine/archive/2010/11/lies-damned-lies- and-medical-science/8269/)

<comment><USER4> 33% of retracted papers were from the US.

30% of retracted papers were from "Asian nations".

The UK, India, China, and Japan each had over 5% of the retracted papers.

33% of retracted US papers were fraudulent. So 67% of their retracted papers were erroneous.

25% of retracted ... is this Asian, or UK/India/China/Japan? papers were fraudulent. So 75% of their retracted papers were erroneous.

How does the percentage of US papers that were retracted, compare the the percentages for other countries (it has number of retracted papers, but not number of non-retracted)? This is necessary to compare the overall percentages of fraudulent/erroneous papers; what I see in the article could mean that US researchers are less likely to make mistakes and equally (or less, even) likely to commit fraud; it doesn't _necesasrily_ mean that US researchers commit more fraud (or make less mistakes).

</comment></comment></comment><comment><USER5> The title is misleading. The abstract of the cited paper <http://jme.bmj.com/content/early/2010/10/18/jme.2010.038125> says that retracted papers from the US published in PubMed had a higher ratio fraudulent to erroneous retractions than those of other nations. Given that the study targets English language publications only and that its results showed that groups of repeat offenders are responsible for the majority of fraudulent retractions, global statements about the likelihood of fake research originating from US scientists cannot be accurately drawn.

<comment><USER6> Additionally, the higher fraud/error ratio might actually mean that US scientists make less methodological errors than other scientists.

It should also be noted that PubMed only covers a small, non-representative part of the entire research landscape.

</comment></comment><comment><USER7> If I'm using it right, it looks like more than 7.5 million papers were submitted to PubMed in this 10 year period. Only 0.01% of all papers were retracted and only 0.003% were retracted due to "fraud". This seems like an exceedingly small sample. I wish we could see more of the raw analysis (p-scores and the like).

I think the other result was more interesting: 53% of "faked" research papers were submitted by "repeat offenders", while only 18% of "erroneous" papers were. If you do this once it seems you are likely to do this again.

BTW, the abstract is at <http://jme.bmj.com/content/early/2010/10/18/jme.2010.038125>

</comment><comment><USER8> Even if a primary research study (such as the one mentioned in the link submitted here) is conducted without deliberate fraud, it may not be meaningful and may not even be true.

<http://norvig.com/experiment-design.html>

To be convinced that the headline statement "US Scientists Significantly More Likely to Publish Fake Research" is true, I would go through Peter Norvig's checklist above, and see how many methodological issues may have been missed by the reported study. Then I would wait for a follow-up study by an independent researcher, preferably with different methodology and definitely based on a different data set. Right now, I have no idea whether or not there are national differences in rates of publication of fake research.

</comment><comment><USER9> one result that seems interesting: "Roughly 53% of fraudulent papers were written by a first author who had written other retracted papers ('repeat offender'), whereas only 18% of erroneous papers were written by a repeat offender."

<comment><USER10> cheaters cheat, but everyone can make a mistake.

</comment></comment><comment><USER11> Note that the study was written by an American.

</comment><comment><USER12> And I'm more likely to ignore useless studies.</comment>


Ask HN: What's your favorite diff merge tool on macOS? - <AUTHOR> I was going to buy a Kaleidoscope licence but then discovered that the last release was from June 2015 and that the software is no longer maintained.<p>I'm looking for good alternatives, any suggestions? <comment><USER2> > last release was from June 2015 ... no longer maintained

Dude. I'm using software that hasn't been maintained since 1983. You're worried about 2015?

<comment><USER3> Software from 1983 that's still around probably has less issues than the average unmaintained project from today, if only because of survivorship bias.

</comment></comment><comment><USER4> I've been using FileMerge "forever". It comes bundled with XCode and can be used in git as "opendiff".

<comment><USER5> I've used the same. One thing that is odd is the "merge" window that shows the final result of the merge that sits below the left and right pane is set to 0 height by default. I've surprised several colleagues by moving my mouse to their bottom pane of FileMerge and dragging up showing them that 3rd pane.

</comment></comment><comment><USER6> Just in case anyone involved reads this: I hate how Black Pixel bought Kaleidoscope just to let it rot.

</comment><comment><USER7> I've been using Kaleidoscope for years... I don't know what feature you could want, maybe audio support? Handles my dev needs already.

</comment><comment><USER8> Happy user of SourceGear DiffMerge here. It's probably not the most beautiful piece of software on the planet, but it gets the job done.</comment>


Visual Programming Is The Future Of Computing - <AUTHOR> http://lunduke.com/?p=1500 <comment><USER2> Not the future of computing... the future of small LOB apps written by fred in sales to keep track of things the CRM software doesn't, or tony in logistics to keep track of stuff that isn't covered by the warehouse management system.

Like VB (pre .net) & Access this will allow the average business user to suddenly create computer software suited to their individual task... and become the bane of IT once it becomes "mission critical" (in the sense that the business looses serious productivity without it) as it will be developed in such a way that "works" but is terribly inefficient. This is not always a bad thing, there can be considerable wisdom in letting these tools develop and not spending real development resources on them until they have proved their worth.

I believe visual programming will become a tool for the serious programmer the day you can reliably visualize a code base like postgreSQL, firefox or Open Office, patch a bug, submit a couple of line diff and have the other contributors none the wiser. Until that point in time I feel it will be nothing but Hypercard with a new coat of pain.

That being said I could see visual programing interface as an improvement on the GUI builder type tools (.Net, Delphi, XCode) where you not only design the static layout, but are able to design animations and transitions visually.

</comment><comment><USER3> Of course it's the future; it's also the past and present. Programming is deeply visual. Any doubt about that, just listen to ruby guys (and gals) praise its gorgeously delimited blocks. Or why do python coders love list comprehensions so much; and javascript folks the ternary operator? Much of the appeal of those agglomerations of symbols is absolutely visual.

If V/P can encode more information on my 40 x 85 editor window, using some other paradigm than what's possible using words plus $@?{(>=+/ then i'll gladly switch. At the moment though, good programmers can easily outrun the state-of-the-art V/P exemplars; my criticism of diagram-to-code tools like Altova UModel (UML-to-Java) or MicroOLAP's Database Designer (UML-to-SQL) is just that i can code more quickly than i can drag boxes and arrows around. i just don't see the coal-powered engine out-running the horse anytime soon.

</comment><comment><USER4> Visual programming may be the future of learning how to build applications, but it's not "the future of computing."

The pattern of visual introduction followed by symbolic mastery occurs again and again:

      1. Learning to count using physical objects
      2. Learning arithmetic using number lines
      3. Learning trigonometry using triangles
      4. Learning geometry with compasses and straight edges
      5. Learning to speak before learning to write
      6. Learning macroeconomics via guns & butter

and on and on...

Visual programming is a great tool, and if we can somehow capture the non- programmer's imagination and guide them to an understanding of controlled flow, subroutines, event handling, multiple threads of execution, etc., then we may get them to the point of converting those notions into written code (the symbolic form of the above). This would be a giant leap forward for empowering users over their individual computing environments.

But let's not fool ourselves and pretend that this is the future of programming for either novices, amateurs, or professionals.

</comment><comment><USER5> I think a visual/natural language command line could be the future of UIs. To get people to use basic visual programming tools instead of relying on trivial apps made by others, you need to force them into it, like BASIC did on old computers. If the divide between programming and general UIs for everyday tasks was reduced, people would be much more receptive of programming. It would involve the same type of thinking they'd practice daily.

OSX Automator makes a whole class of quickie apps redundant. Batch renamers, resizers, converters are a few autocompletes and drag and drops away. Mathematica and Wolfram Alpha let you do annoying little programming tasks with a large library of curated functions accessed with autocomplete/natural language - [http://blog.wolfram.com/2010/11/16/programming-with- natural-...](http://blog.wolfram.com/2010/11/16/programming-with-natural- language-is-actually-going-to-work/)

A visual/natural language command line could do the same for general computer use. Instead of finding some tiny poorly designed buttons in a giant app, you'd type in what you want and find it faster, foregoing the usual step of the application's help. A simple example would be removing red eye in photoshop. Finding that tool for novices is the full app is impractical. So they're forced to get dumbed down photoshop where the tool's placement is more obvious. Instead they could have typed red eye, scary eye, fix eyes, into the full app.

Also the placement of red-eye remover is so obvious in basic photo editors that they leave little room in the UI for other common tasks. What about make skinny? Remove wrinkle/pimple? Those become far harder to present with the GUI paradigm. Heal brush and liquify are not helpful names for novices.

The modern GUI strayed too far from the command line in order to remove modes and make computers novice friendly. Other directions weren't thoroughly explored.

</comment><comment><USER6> Ugh. No. I've recently had the bad luck to debug a program in National Instruments' LabView. I felt like screaming and tearing down walls. On the other hand, the best visual programming experience I had was Pentaho's Kettle ETL tool, and even that I still prefer to write code.

EDIT: Ah, I noticed the author mentioned LabView, and I very much agree with this statement:

> But the average user doesn't need that!

>But those tools give people power. They enrich lives. They save time. They make previously impossible (or close to impossible) tasks… possible.

I disagree with this:

> And that is what Visual Software Creation is all about.

Please, by all means teach people programming and basic algorithm. Visual programming is still a terrible shortcut.

<comment><USER7> LabVIEW! I, too, recall my mixed feelings when I started with it. It's much easier for people who have never programmed before--there's no weird syntax to learn (why can't I use = to compare?)--but I've found resistance in said users not wanting to move on to a language with widespread, real world use (like C++).

Is it worth starting with it? I'm not entirely sure. I'm under the belief that such "difficult" hurdles from which a visual programming language protects one are best learned while still learning the simplest concepts.

</comment></comment><comment><USER8> General-purpose visual programming will only succeed for pure functional programming languages, and even then, it will only succeed when people realize that programs are graphs, not lists or trees. He says.

</comment><comment><USER9> I think Visual Programming is best with the User Interface creation mechanisms, but aside from that, it is much, much harder to handle projects of any side using only the Visual Programming paradigm.

</comment><comment><USER10> Most applications need to CRUD. They need drop downs and tabs. That's why we have visual designers for forms. That's why we have Content Types for CMS. So there are definitely patterns that we are extracting out into user- configurable interfaces that don't require coding.

That true for most things. Computer games need editors for game designers to manipulate the environment. Spreadsheets allow for any type of equation to be entered etc.

With 'workflow' editors you can even get into a lot of logic configuration in a practical way.

Its not practical to try to encode everything that way, but quite a bit of the stuff that is being sort of repeatedly coded in different ways is the type of thing that we really could just have widgets or configuration screens for if we were reusing code properly. <http://en.wikipedia.org/wiki/Intentional_programming></comment>


Microsoft shipped a broken DCOM CD-ROM and no-one noticed - <AUTHOR> https://ceklog.kindel.com/2020/02/04/work-backwards-from-the-customer/ <comment><USER2> Not to take away from the story, but the thought that only one person noticed is likely wrong. Only one person understood the problem AND made it through the gauntlet of reporting the issue.

Just something that always seems glaring when people discuss things like support volume.

<comment><USER3> Yea, a lot of people are used to large vendors over promising on tech that doesn't work. As soon as they find issues with it, they don't fiddle with it to make it work, they move on to something else that seems more stable.

In 1996 I was weary of anything Microsoft made, let alone something that wouldn't even compile. The fact that they distributed a CD with missing files which made it 100% defective re-affirms why people were weary of their products. They didn't even bother doing _ANY_ testing of how it was distributed.

</comment></comment><comment><USER4> On the one hand I feel bad that my first thought upon loading that page was "oooh, an FJ-40 Landcruiser." On the other, it just brought back memories of pulling out my hair getting custom marshalling to work over an authenticated DCOM connection.

Definitely not fun times remembered :-(

</comment><comment><USER5> Fun story. DCOM was so cool back in the day.</comment>